Casbin之支持域/租户的RBAC
1.mole.conf文件
[request_definition]
r = sub, dom, obj, act
[policy_definition]
p = sub, dom, obj, act
[policy_effect]
e = some(where (p.eft == allow))
[role_definition]
g = _,_,_
[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act
![image-20220216174211925](https://i-blog.csdnimg.cn/blog_migrate/5acba028e76382f312f561a311fc04f4.png)
2.Policy.csv文件
p, admin, tenant1, data1, read
p, admin, tenant2, data2, read
g, dajun, admin, tenant1
g, dajun, developer, tenant2
![image-20220216174424210](https://i-blog.csdnimg.cn/blog_migrate/346da14a8405af2e750a4b2801ba7a7e.png)
3.main
package main
import (
"fmt"
"github.com/casbin/casbin/v2"
"log"
)
func check(e *casbin.Enforcer, sub, domain, obj, act string) {
ok, _ := e.Enforce(sub, domain, obj, act)
if ok {
fmt.Printf("%s CAN %s %s in %s\n", sub, act, obj, domain)
} else {
fmt.Printf("%s CANNOT %s %s in %s\n", sub, act, obj, domain)
}
}
func main() {
e, err := casbin.NewEnforcer("./casbin/model.conf", "./casbin/policy.csv")
if err != nil {
log.Fatalf("NewEnforecer failed:%v\n", err)
}
check(e, "dajun", "tenant1", "data1", "read")
check(e, "dajun", "tenant2", "data2", "read")
}
4.输出及结构
![image-20220216180518246](https://i-blog.csdnimg.cn/blog_migrate/be8ca146f15e183c3d0b59c61701ca5b.png)
![image-20220216180530957](https://i-blog.csdnimg.cn/blog_migrate/ed8e35002aa022bfca65e2de495bc003.png)
5.讲解
![image-20220216173354572](https://i-blog.csdnimg.cn/blog_migrate/8cbdaa3c76ca8ba94ca6c808c2ad2b44.png)